Preface: Sometimes misconfiguration or abuse will be transformed as a vulnerability. Background: Apache Module mod_lua (Official note) -This module holds a great deal of power over httpd, which is both a strength and a potential security risk. It is not recommended that you use this module on a server that is shared with users you…

Preface: CISA urges vigilance on the VMware Workspace ONE UEM console. Background: The aim of configure the httphandler for display blobs (Binary Large Object) such as an image, a video or a file.In a nutshell the blobhandler allows us to get an URL to diplay a blob stored in our database.Whether is there any cyber…

Preface: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Background: The Auth0 Next. js SDK is a library for implementing user authentication in Next[.] js applications. Auth0 offers two ways to implement login authentication for your applications: Universal Login where users log in to your application through a page…

Preface: The biggest advantage for Android is actually in hardware, not software. The best part of Android platform is that it is flexible in accommodating third party applications which facilitates the Android user to add more functionality in his/her mobile device. Background: Configfs is a ram-based filesystem that provides the converse of sysfs’s functionality. Where…

Preface: The Oracle 10g limitation of 1000 items in a static IN clause. How do you increase maximum number of expressions in a list is 1000 in Oracle? Any in statement like x in (1,2,3) can be rewritten as (1,x) in ((1,1), (1,2), (1,3)) and the 1000 element limit will no longer apply. Background: SAP…

Preface: We like Java and sometimes we hate it. People think that the php programming language will be eliminated, but there are still many people still using it. Background: Apache is a pioneer in occupying the Web server platform market. Over time, people worry about the weaknesses of the Apache overall design. So a group…

Preface: Some people say that CGI-Bin is a historical site. Today’s onerous security environment, perhaps not people use it. The truth tell us is that CGI-Bin still have space for survival. Background: About two months ago, the proof of concept for CVE-2021-41773 (Apache 2.4.49 & 2.4.50) vulnerability was released. The remedy solution is modify the…

Preface: Perhaps we still remember a denial of service tool so called slow http attack. It can easily to make a Apache server out of resources less than minute. UTM firewall contains many components. For example, SSL VPN gateway. From technical point of veiw, this module also similar a HTTPS web server. If it contain…

Preface: If it is a integer, just use it directly. If it is a pointer, need to check for valid user address: int access_ok(int type, const void *addr, unsigned long size); Background: IOCTL is referred as Input and Output Control, which is used to talk with device drivers. IOCTL is a system call where system…